diff options
| author | Matt Graeber <mattgraeber@gmail.com> | 2013-05-31 19:35:26 -0400 |
|---|---|---|
| committer | Matt Graeber <mattgraeber@gmail.com> | 2013-05-31 19:35:26 -0400 |
| commit | dfec277813bfbc956dcac45345a9158093d68343 (patch) | |
| tree | f205c4c4d6e81f33ace8086bbf63881ffc12dd51 /CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm | |
| parent | 6e5338c8a34ade0ec0a4704031109fb5187620f8 (diff) | |
| download | PowerSploit-dfec277813bfbc956dcac45345a9158093d68343.tar.gz PowerSploit-dfec277813bfbc956dcac45345a9158093d68343.zip | |
Added Invoke-ReflectivePEInjection
Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection
is a vast improvement over Invoke-ReflectiveDllInjection. It adds the
following features:
* Now supports loading exe files in memory
* Supports reflective dll injection into a remote process
* Additional sample Visual Studio solutions
Diffstat (limited to 'CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm')
| -rw-r--r-- | CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm new file mode 100644 index 0000000..41b1034 --- /dev/null +++ b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm @@ -0,0 +1,23 @@ +[SECTION .text] +global _start + +_start: + ; Get stack setup + push ebx + mov ebx, esp + and esp, 0xfffffff0 + + ; Call DllMain + mov ecx, 0x41414141 ; DLLHandle, set by PowerShell + mov edx, 0x1 ; PROCESS_ATTACH + mov eax, 0x0 ; NULL + push eax + push edx + push ecx + mov eax, 0x41414141 ; Address of DllMain, set by PS + call eax + + ; Fix stack + mov esp, ebx + pop ebx + ret |